Manually Configuring Ipsec And Ike - Cisco MDS 9000 Series Configuration Manual

Manually Configuring IPsec and IKE

• Only those certificates that are configured for IKE or general usage are used by IKE.
• The first IKE or general usage certificate configured on the switch is used as the default certificate by
• The default certificate is for all IKE peers unless the peer specifies another certificate.
• If the peer asks for a certificate which is signed by a CA that it trusts, then IKE uses that certificate, if it
• If the default certificate is deleted, the next IKE or general usage certificate, if any exists, is used by IKE
• Certificate chaining is not supported by IKE.
• IKE only sends the identity certificate, not the entire CA chain. For the certificate to be verified on the
Manually Configuring IPsec and IKE
This section describes how to manually configure IPsec and IKE.
IPsec provides secure data flows between participating peers. Multiple IPsec data flows can exist between
two peers to secure different data flows, with each tunnel using a separate set of SAs.
After you have completed IKE configuration, configure IPsec.
To configure IPsec in each participating IPsec peer, follow these steps:
Procedure
Step 1 Identify the peers for the traffic to which secure tunnels should be established.
Step 2 Configure the transform set with the required protocols and algorithms.
Step 3
Create the crypto map and apply access control lists (IPv4-ACLs), transform sets, peers, and lifetime values
as applicable.
Step 4
Apply the crypto map to the required interface.
Example
This section contains the following topics:
About IKE Initialization
The IKE feature must first be enabled and configured so the IPsec feature can establish data flow with the
required peer. Fabric Manager initializes IKE when you first configure it.
You cannot disable IKE if IPsec is enabled. If you disable the IKE feature, the IKE configuration is cleared
from the running configuration.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
176
IKE.
exists on the switch, even if it is not the default certificate.
as the default certificate.
peer, the same CA chain must also exist there.
Configuring IPSec Network Security